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Top Stories 

• Swiss-based oil services company Weatherford International Ltd., agreed to pay over $252 
million to settle U.S. allegations that it bribed officials in several countries and violated 
sanctions. - Bloomberg News (See item 1) 

• Ford initiated a recall of almost 140,000 model year 2013 Escape vehicles equipped with 
1.6 liter engines that may experience engine fires. - Detroit News (See item 3) 

• A broken water main caused 8,000 residents and 2,000 businesses in Cayce, South 



West Columbia schools. - Columbia The State (See item 18) 

• Researchers identified a trojan called Shez that disguises itself as an AutoCAD component 
in order to allow attackers to steal files and plant additional malware at a later date. - Help 
Net Security (See item 29) 
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Energy Sector 



1. November 26, Bloomberg News - (International) Weatherford International settles 
foreign bribery probes. The Swiss-based oil services company, Weatherford 
International Ltd., agreed to pay over $252 million to settle U.S. allegations that it 
bribed officials in several countries and violated sanctions by authorizing bribes 
intended for foreign officials from 2002 to July 2011 in order to obtain or retain 
business or for other benefits. 

Source: http://www.bloomberg.com/news/2013-l 1-26/weatherford-international- 
settles-u-s-foreign-bribery-probes.html 

2. November 26, Toledo Blade - (North Dakota; Wisconsin) Marathon, Enbridge team 
up on pipeline. Officials from Marathon Petroleum Corp. announced November 25 
that Enbridge Energy Partners LP will join them in the development of the estimated 
$2.6 billion Sandpiper Project, a crude oil pipeline from North Dakota to Wisconsin. 
The pipeline is expected to be operational by 2016. 

Source: https://www.toledoblade.com/Energy/2013/ll/26/Marathon-Enbridge-team- 
up-on-pipeline .html 

[ Return to top ] 

Chemical Industry Sector 

See item 16 
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Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

3. November 26, Detroit News - (National) Ford recalling 2013 Escape SUVs for fire 
risks. Ford initiated a recall of almost 140,000 model year 2013 Escape vehicles 
equipped with 1.6 liter engines that may experience engine fires caused by engine 
cylinder head overheating, which can lead to cracking and oil leaks. Among the 
recalled vehicles, 9,469 are part of a second recall to fix a fuel leak issue that could also 
result in engine compartment fires. 

Source: http ://w w w . detroitne w s . com/article/20 1311 26/AUTOO 1 02/3 1126005 2/F ord- 
recalling-1 40-000- 13-Escape-SUVs-fire-risks 

For another story, see item 29 
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Defense Industrial Base Sector 



See item 29 
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Financial Services Sector 

4. November 26, Softpedia - (International) Experts warn of new banking trojan 
Neverquest. Security researchers have observed thousands of attempts to infect 
computers using the Neverquest banking trojan, a relatively new trojan that injects a 
phishing page into sessions when users attempt to access banking Web sites. The trojan 
has integrated self-replication mechanisms and is distributed via trojan downloaders. 
Source: http://news.softpedia.com/news/Experts-Warn-of-New-Banking-Troian- 
Neverquest-403685.shtml 

5. November 26, U.S. Securities and Exchange Commission - (Texas) SEC announces 
charges against two Houston-based firms for engaging in thousands of undisclosed 
principal transactions. The U.S. Securities and Exchange Commission announced 
November 26 charges alleging that Houston-based Parallax Investments LLC, Tri-Star 
Advisors, and three of their executives engaged in thousands of principal transactions 
through their affiliated brokerage firm without informing their clients, collectively 
making more than $2 million on the trades. 

Source: http ://w w w. sec. go v/New s/Pres sRelease/Detail/Pres sRelease/ 13705 404 14827 

6. November 25, Newark Star-Ledger - (Florida; New Jersey) Feds charge ex- 
Monmouth County man with running $18m Ponzi scheme. A Miami man was 
arrested and charged by federal authorities with allegedly running an $18 million Ponzi 
scheme that defrauded 28 investors by claiming to invest their funds through his 
company, Fair Haven, New Jersey-based LJS Trading. 

Source: http://www.ni.com/business/index.ssf/2013/ll/feds charge ex- 
monmouth county.html 

For additional stories, see items 1 and 11 
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Transportation Systems Sector 

7. November 26, Milwaukee Journal Sentinel - (Wisconsin) HAZMAT cleanup takes 
hours after deadly Wisconsin ammonia truck crash. A fatal accident involving a 
semi-truck carrying ammonia and another vehicle on Highway 1 1 in Shullsberg 
November 25 killed one driver and closed the highway for an undisclosed amount of 
time as HAZMAT teams cleaned up the toxic spill into November 26. 



-3 - 



Source: http://www.isonline.com/news/traffic/hazmat-cleanup-takes-hours-after- 
deadly-wisconsin-ammonia- truck-crash -b99 1 509 1 4z 1 -2334567 1 1 .html 



8. November 26, Maritime Executive - (Iowa) Towboat sinks, leaks oil on Mississippi 
River. A 144-foot towboat vessel carrying 100,000 gallons of petroleum products 
struck a submerged object, sank, discharged oil into the Mississippi River near 
LeClaire, Iowa, and prompted the closure of a portion of the river so authorities could 
clean up the spill November 25. 

Source: http://www.maritime-executive.com/article/Towboat-Sinks-Leaks-Oil-on- 
Mississippi-River-2013-11-26/ 

9. November 26, Saginaw News - (Michigan) Part of 1-75 shutdown after multi-car 
crash near mile marker 144. Icy roads caused a multi-vehicle accident on Interstate 
75 in Saginaw County November 25 that closed northbound and southbound lanes for 
about 4 hours into November 26. 

Source: http://www.mlive.com/news/saginaw/index.ssf/2013/ll/part of i- 
75 shutdown by after.html 

10. November 26, Arizona Department of Transportation - (Arizona) Interstate 8 ramp to 
I- 10 East closed. An accident involving a semi-truck that rolled over on Interstate 8 in 
Phoenix closed all eastbound traffic for an undisclosed amount of time November 26. 
Source: http://www.azfamilv.com/traffic/Interstate-8-ramp-to-I-10-East-closed~ 
233452361 .html 

11. November 25, New Hyde Park Patch - (New York) DA: More charges for accused 
LIRR scammers. The Nassau County District Attorney announced upgraded charges 
against four Romanian nationals arrested and charged with allegedly installing 
skimming devices on Long Island Railroad ticket machines. A fifth suspect was also 
charged in the alleged scheme, though he recently fled to the U.K. following the arrests 
of the other suspects. 

Source: http://newhvdepark.patch.com/groups/police-and-fire/p/da-more-charges-for- 
accused-lirr-scammers 

12. November 25, USA Today - (National) Ex-flight attendant jailed for bogus bomb 
threats. A former United Airlines flight attendant from Dallas was sentenced to 18 
months in federal prison for calling in eight phony bomb threats against the carrier 
between October 2012 and January 2013 that caused disruptions including plane 
evacuations and canceled flights. 

Source: http://www.postcrescent.com/usatodav/article/3712067 

13. November 25, WSVN 7 Fort Lauderdale - (Florida) FBI and DEA investigate office 
at Fort Lauderdale Airport. The World Jet headquarters at the Fort Lauderdale 
Executive Airport was investigated by the Drug Enforcement Administration for being 
a suspected site of drug trafficking and money laundering activities. 

Source: http://www.wsvn.com/news/articles/local/210123Q9595874/fbi-and-dea- 
investigate-office-at-fort-lauderdale-airport/ 
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For another story, see item 15 
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Food and Agriculture Sector 

14. November 26, Food Safety News - (National) Mandatory country-of-origin meat 
labeling now in effect. A new rule known as country-of-origin labeling (COOL) that 
became effective November 23 requires labeling of meats indicating where it 
originated. 

Source: http://www.foodsafetvnews.eom/2013/l l/mandatory-country-of-origin- 
labeling-on-meat-goes-into-full-effect/ 

15. November 25, WKYT 36 Lexington - (Kentucky) Crews battle fire at Corbin ice 
factory. A factory fire at the Corbin Ice Company in Whitley County closed 
Cumberland Falls Highway for several hours November 25. 

Source: http://www.wkyt.com/news/state/headlines/Crews-battle-fire-at-Corbin-ice- 
factory-233287101.html 

16. November 25, St Louis Post-Dispatch - (Missouri) Ammonia leak contained at 
refrigerated warehouse in Fairmont City. An ammonia gas leak from a gasket on a 
refrigeration compressor at the Polarville refrigerated warehouse in Fairmont City 
prompted authorities to shut down the system and evacuate the nearby industrial area 
November 25. 

Source: http://www.stltodav.com/news/local/crime-and-courts/crews-respond-to- 
anhydrous-ammonia- leak-in-fairmont-city/article 43368878-1 lea-54ea-8009- 
eb634fb8498f.html 

17. November 23, U.S. Food and Drug Administration - (National) Jayone food issues 
voluntary alert on undeclared peanuts in dried seaweed salad. Jayone Foods, Inc., 
of Paramount, California, voluntarily recalled Trader Joe’s Dried Seaweed Salad with 
Spicy Dressing products because it may contain peanuts that were undeclared. 

Source: http://www.fda.gov/Safety/Recalls/ucm376469.htm 

I Return to top i 

Water and Wastewater Systems Sector 

18. November 25, Columbia The State - (South Carolina) Water restored in Cayce 
following 17-hour power outage. A 16-inch water main broke November 25 due to 
freezing old pipes and caused 8,000 residents and 2,000 businesses in Cayce to be 
without water for several hours while forcing the closure of 10 Cayce and West 
Columbia schools. Service workers restored the water and issued a 24-hour boil water 
advisory. 

Source: http://www.thestate.com/2013/ll/25/312152Q/water-break-thousands-of- 
students.html 
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19. November 25, WDAM 7 Laurel - (Mississippi) $20,000 worth of damage and theft at 
Columbia treatment facility; city offers reward. The Columbia Board Alderman is 
offering a reward for information on vandals that caused over $20,000 in damage to 
Columbia South’s sewage treatment lagoon by stealing a boat, tearing down gates, 
stealing a pump, and shooting up aerators. 

Source: http://www.wdam.com/storv/24066724/20000-worth-of-damage-and-theft-at- 
columbia-treatment-facility-city-offers-reward 

20. November 25, U-T San Diego - (California) Sewage spill contaminates Lake 
Calavera. An 1 1,400-gallon sewage spill believed to have originated from a broken 
water main leaked 8,400 gallons of sewage into a storm drain that empties into Lake 
Calavera in Carlsbad November 25. Signs will be posted warning of the sewage 
contamination on the north and west portions of the lake until testing is completed. 
Source: http://www.utsandiego.com/news/2013/nov/25/oceanside-carlsbad-sewage- 
spill-lake-calavera/ 

For another story, see item 8 
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Healthcare and Public Health Sector 

21. November 25, WKYC 3 Cleveland - (Ohio) Fire damages CVS pharmacy. Fire crews 
responded to a fire at a CVS pharmacy in Cleveland November 25 that started in the 
pharmacy area and caused an estimated $300,000 in damage. 

Source: http://www.wkvc.com/storv/news/local/2013/ll/25/cvs-fire/3720197/ 
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Government Facilities Sector 

22. November 26, Watauga Democrat - (North Carolina) Closings and delays for Nov. 
26 , 2013 . Watauga County Schools closed due to a power outage and Sugar Grove 
Developmental Day School closed due to heating issues November 26. Severe weather 
prompted several other schools in the area to delay opening. 

Source: http://www2.wataugademocrat.com/Breaking News/story/UPDATED- 
Closings-and-delays-for-Nov-26-20 1 3-id-0 13314 

23. November 25, USA Today - (National) Former TSA supervisor charged with 
trafficking cocaine. Federal officials announced that a former Transportation Security 
Administration supervisor was indicted, along with an accomplice, for allegedly 
helping smuggle at least 1 1 pounds of cocaine through the U.S. Virgin Islands in 2012. 
Baggage handlers in St. Thomas were also charged with smuggling drugs in colorfully 
marked luggage into the U.S. 

Source: http://www.usatodav.com/story/news/nation/2013/ll/25/tsa-cocaine- 
trafficking/3691957/ 



- 6 - 



24. November 25, Associated Press - (Indiana) Students from storm-damaged 
Tippecanoe County schools return to classes. Over 900 Tippecanoe County students 
returned to classes November 25 after severe storms November 17 damaged two 
schools near Lafayette. The students were placed in temporary classrooms at 
neighboring schools while crews spend at least a few months making repairs. 

Source: http://posttrib.suntimes.com/news/23991942-418/students-from-storm- 
damaged-tippecanoe-county-schools-retum-to-classes.html 

25. November 25, WLS-TV 7 Chicago - (Illinois) Students hospitalized after chemical 
lab fire. Five students from Lincoln Park High School in Chicago were transported to 
an area hospital after a fire broke out in the chemical lab while they were doing an 
experiment November 25. 

Source: 

http://abclocal.go.com/wls/storv?section=news/local/chicago news&id=9339275 

26. November 25, Portsmouth Herald - (New Hampshire) Portsmouth Middle School 
closes after burst pipe causes damage. Portsmouth Middle School in New Hampshire 
was closed November 26 after a frozen sprinkler pipe burst in a bathroom, causing the 
sprinkler system to be inoperable until repairs can be made. 

Source: http :l/w w w. seacoastonline.com/articles/20 1311 25-NEW S-131129811 

27. November 25, Associated Press - (Iowa) ‘Phishing’ attack dupes dozen of U Iowa 
employees. At least 82 University of Iowa employees had their accounts accessed by 
unauthorized individuals November 24-25 in what officials believe was a phishing 
attack. Hackers stole about $20,000 from two employees and were able to successfully 
change deposit information for about five employees. 

Source: http://www.thestate.com/2013/ll/25/3121945/phishing-attack-dupes-74- 
more.html 



For another story, see item 18 
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Emergency Services Sector 

See item 35 
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Information Technology Sector 

28. November 26, Softpedia - (International) Atrax: Cybercrime kit capable of stealing 
data, launching DDoS, mining for Bitcoins. Security researchers at CSIS identified a 
new malware kit called Atrax being sold for $250 on underweb forums. Atrax uses The 
Onion Router (TOR) protocol to hide its communications and comes with several add- 
ons that allow it to steal data from forms and browsers, launch distributed denial of 
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service (DDoS) attacks, and mine for Bitcoins and Litecoins. 

Source: http://news.softpedia.com/news/Atrax-Cybercrime-Kit-Capable-of-Stealing- 
Data-Launching-DDOS-Mining-for-Bitcoins-4Q3632.shtml 

29. November 26, Help Net Security - (International) AutoCAD malware paves the way 
for future attacks. TrendMicro researchers identified a trojan called Shez that 
disguises itself as an AutoCAD component in order to create a user account with 
administrative rights, allowing attackers to steal files and plant additional malware in 
the future. The trojan is either dropped by other malware or can be downloaded 
unknowingly from malicious sites. 

Source: http://www.net-securitv.org/malware news.php?id=2635 

30. November 26, Softpedia - (International) Experts warn of an increase in the usage of 
Blackshades RAT. Symantec researchers found that the Blackshades remote access 
trojan (RAT) has increased in use over the past 5 months. The researchers also found a 
link between Blackshades and the Cool Exploit Kit, where the latter is used to drop the 
former as well as other pieces of malware. 

Source: http://news.softpedia.com/news/Experts-Warn-of-an-Increase-in-the-Usage-of- 
Blackshades-RAT-403525.shtml 



31. November 26, Threatpost - (International) Blackhole and Cool Exploit Kit nearly 
extinct. A security researcher monitoring the sale and use of exploit kits found that the 
use of Blackhole and Cool exploit kits have decreased significantly in the 6 weeks since 
their alleged creator was arrested. However, the Reveton gang malware group continues 
to use a custom version of Cool for the distribution of ransomware. 

Source: http://threatpost.com/blackhole-and-cool-exploit-kits-nearly-extinct 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

32. November 25, Reuters - (National) New agreement gets Pentagon closer to clearing 
airwaves for sale. The U.S. Department of Defense reached an agreement with 
broadcasting industry officials to share some radio airwaves used for military systems 
in order to allow them to be auctioned off for use by the private sector. 

Source: http://www.globalpost.com/dispatch/news/thomson-reuters/131125/new- 
agreement-gets-pentagon-closer-clearing-airwaves-sale 
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Commercial Facilities Sector 



33. November 25, Associated Press - (Maryland) 20 displaced by Ellicott City 
apartment fire. A fire at an apartment building in Ellicott City, Maryland, displaced 
about 20 residents November 25 while all of the apartments in the six-unit building 
were expected to be declared uninhabitable. 

Source: http://washington.cbslocal.eom/2013/l 1/25/20-displaced-by-ellicott-city- 
apartment-fire/ 

34. November 25, Florida Times-Union - (Florida) Jacksonville apartment fire displaces 
several families. A November 25 fire at the Victory Pointe apartments in Jacksonville, 
Florida, displaced 21 residents and damaged six units. Officials are investigating the 
cause of the fire but believe it began in one of the apartments on the west side. 

Source: http://iacksonville.com/breaking-news/2013-ll-25/storv/iacksonville- 
apartment-fire-displaces-several-families 

35. November 25, WTVF 5 Nashville - (Tennessee) 9 treated after fire, meth lab bust in 
Franklin County. Nine Fra nk lin County Sheriffs Office members were treated after 
being exposed to chemical fumes and contaminated air after they responded to a meth 
lab in a mobile home at All Seasons Campground in Estill Springs November 24. Faw 
enforcement safely removed all dangerous and flammable chemicals. 

Source: http://www.newschannel5.com/story/24064236/9-treated-after-fire-meth-lab- 
bust-in-franklin-county 

36. November 24, Easton Express-Times - (New Jersey) Union Township condo fire 
started outside building, prosecutor says. New Jersey State Police are continuing to 
investigate a November 23 fire at the Union Hill complex in Union Township that 
damaged or destroyed 18 condominiums and displaced several residents. Prosecutors 
believe the fire began outside the building. 

Source: http://www.lehighvallevlive.com/hunterdon-county/express- 
times/index.ssf/2013/1 1/union township condo fire star.html 

For another story, see item 18 
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Dams Sector 



37. November 25, Edwardsville Intelligencer - (Illinois) Uevee Issues Alliance supports 
council’s decision. The Flood Prevention District Council will begin work on two 
levee projects as designed by the U.S. Army Corps of Engineers on the Wood River 
Drainage and Fevee District as well as the Metro East Sanitary District Fevee by the 
end of 2015. 

Source: http://www.theintelligencer.com/local news/article bdOcfaeO-55f7-l le3-9ael- 
Q01a4bcf887a.html 
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DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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